Candiru's Attack Playbook: From Sherlock Zero-Click to AdFection Ad-Based Delivery

The evolution of Candiru's delivery methods

Candiru's offensive evolution can be traced through the delivery methods it has used over time. Each method represents a different approach to the fundamental problem of getting the exploit to the target's device, and each innovation has expanded the operator's ability to reach targets who are increasingly aware of traditional attack vectors.

The earliest publicly documented Candiru attacks relied on exploit links, where the victim was sent a URL that triggered the exploit chain when visited. This is the simplest delivery method but also the most detectable, because the victim must interact with a suspicious link, and the same URL serves the same payload to everyone who visits it.

Candiru marketed a multi-platform zero-click vector called Sherlock, which represented a significant offensive advance because it eliminated the need for the victim to click anything. Sherlock-style targeting, as the concept became known in the industry, aimed to deliver exploits through channels that the target used regularly without any interaction, such as messaging platforms or background services.

The Sherlock concept and ADINT-assisted exploitation

The Sherlock concept represents a strategic shift in how spyware operators approach targeting. Rather than engineering a specific interaction with the target, the operator seeks to deliver the exploit through a channel the target already uses, without any action on the target's part. This is the zero-click paradigm that has driven much of the mercenary spyware industry's investment in recent years.

ADINT, or advertising intelligence, is the use of advertising-derived data for intelligence purposes. The idea of ADINT-assisted exploitation is that the advertising ecosystem, which collects extensive data about devices and users for ad targeting, can be repurposed to identify and track specific targets. This concept has been discussed in the industry for years, sometimes called Sherlock-style targeting or advertising-based infection.

What makes the October 2026 Citizen Lab disclosure important is that researchers now have a documented chain connecting commercial ad auctions, target-specific JavaScript, Candiru validation infrastructure, Candiru infection, and Candiru C2 in real victims. The AdFection campaign is the first public technical confirmation that this concept has been operationalized.

AdFection as the operationalization of Sherlock-style targeting

AdFection can be understood as the operationalization of the Sherlock-style targeting concept using the advertising ecosystem. The attack chain proceeds from target identification through advertising identifiers, to winning an ad impression, to selective JavaScript delivery, to device profiling through a Candiru validator, to exploit delivery, and finally to the Candiru implant.

The offensive innovation is not in the exploit itself or in the implant. DevilsTongue, the Windows implant, was documented by Microsoft in 2021 and its core capabilities have not fundamentally changed. The innovation is in the delivery and targeting infrastructure, which solves the problem of finding and reaching the target's device at scale.

From the operator's perspective, AdFection potentially changes the attack model from target to WhatsApp, SMS, email account, message, exploit to target identity, advertising identifier or IP, global advertising network finds target, exploit appears wherever the target happens to browse. The attacker no longer needs to care whether the person opens CNN, a weather app, a game, or some unrelated website. They only need the target's device to encounter advertising inventory they can bid on.

The exploit chain: what we know and what we don't

Candiru has repeatedly demonstrated access to expensive browser and Windows exploit chains. Previous research linked the company to CVE-2021-31979 and CVE-2021-33771, both Windows kernel elevation-of-privilege vulnerabilities, and to Chrome V8 exploitation including CVE-2021-21166 and CVE-2021-30551. Microsoft also linked Candiru to CVE-2021-33742, an MSHTML remote code execution vulnerability. In 2022, Avast linked Candiru to CVE-2022-2294, a Chrome and Android V8 heap buffer overflow.

This history demonstrates that Candiru has maintained access to browser-to-Windows exploit chains capable of the final compromise stage that AdFection's delivery method requires. A browser exploit can achieve code execution in the browser process, and from there, a Windows kernel elevation-of-privilege exploit can achieve system-level access, which is necessary for installing a kernel-mode implant like DevilsTongue.

What we do not know is the specific exploit chain used in the 2024 to 2025 Al Jazeera infections. Citizen Lab has not publicly disclosed whether the attacks used previously unknown vulnerabilities, meaning zero-days, or patched exploits against outdated machines. No new CVE has been attributed to the AdFection campaign. This is a significant gap because it means defenders cannot patch against a specific identified vulnerability; they must rely on behavioral detection and infrastructure blocking.

What this evolution tells us about the threat landscape

The evolution from exploit links to Sherlock to AdFection reveals a trend toward delivery methods that require less and less target interaction and that leverage existing infrastructure rather than creating new attack infrastructure. Each innovation reduces the operational cost of targeting a specific individual while increasing the difficulty of detection.

AdFection is particularly significant because it leverages infrastructure that already reaches nearly every internet user. The programmatic advertising ecosystem is embedded throughout the normal web and app experience, which means the attack surface is not a specific website or service that can be blocked, but the entire advertising layer of the internet.

The implication for high-value targets is that the threat model has changed. Zero-click spyware no longer necessarily needs to come through WhatsApp, iMessage, SMS, or a malicious link. The advertisement infrastructure embedded throughout normal websites and applications can now act as the delivery channel. This means that for journalists, government officials, and other high-risk individuals, the defensive posture must account for advertising as an attack vector, not just as a privacy concern.

Frequently asked questions

Related research